Release via tanem/release-action - #1577
Merged
Merged
Conversation
Replaces the tanem-scripts release command with the composite action. The version bump still comes from the labels on PRs merged since the last tag; what changes is what produces it and what it writes. The workflow drops the RELEASE_TOKEN checkout credential: the action pushes the bump commit and tag with the ambient GITHUB_TOKEN. That only works because master's required status check has been removed — a GITHUB_TOKEN push cannot trigger workflows, so a bump commit can never earn a `ci` check of its own, and waiting for one would deadlock. setup-node loses registry-url, which trusted publishing makes redundant, and cache: 'npm', which the fleet workflow shape does not carry. The git-identity step goes too: the action sets github-actions[bot] itself. The `if: github.ref == 'refs/heads/master'` guard stays. This repo stages breaking work on long-lived v* branches; the cron only ever fires on the default branch, but a manual dispatch can target any branch, and without the guard one of those would publish a half-finished major. npm ci, the Playwright browser install and npm test are load-bearing steps, not hygiene. This package has no prepublishOnly, so the dist/ that reaches the registry is the one npm test builds, and the tests gate the release exactly as they did under the old flow. CHANGELOG.md is closed at v12.1.0; GitHub Releases takes over, categorised by the same labels through .github/release.yml. AUTHORS is left in place but goes stale — nothing regenerates it now, and removing a contributor credit is a separate call. Regenerating the lockfile also corrects a stale packages[""].version it had been carrying.
tanem
force-pushed
the
release-via-action
branch
from
August 8, 2026 04:12
e8368e1 to
34ec8d6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves this repo's release off the
tanem-scriptsnpm package and onto thetanem/release-actioncomposite action, SHA-pinned to v0.1.0. The label-driven bump, the Monday cron and the OIDC provenance publish all carry over unchanged — what goes away is the devDependency, theRELEASE_TOKENPAT and the regeneratedCHANGELOG.md.The workflow keeps its filename, which is load-bearing: npm's trusted publisher for this package matches on repo plus workflow filename, so renaming it would need the publisher updated first.
npm ci, the Playwright browser install andnpm testare equally load-bearing — this package has noprepublishOnly, so thedist/that reaches the registry is the onenpm testbuilds, and the tests gate the release exactly as they did before. All three were verified locally: a fullnpm testpasses and leaves the working tree clean, which matters becausenpm versionrefuses a dirty tree.The
if: github.ref == 'refs/heads/master'guard stays, and is a deliberate deviation from the shape the other fleet repos take. This repo stages breaking work on long-livedv*branches; the cron only ever fires on the default branch, but a manual dispatch can target any branch, and without the guard one of those would publish a half-finished major.AGENTS.mdalready documents that guard as load-bearing, so dropping it for uniformity would have been a silent regression.The push now uses the ambient
GITHUB_TOKENinstead ofRELEASE_TOKEN. That required removing master's requiredcistatus check, since a push made withGITHUB_TOKENdoes not trigger workflows and so a bump commit can never earn a check of its own. Force-push and deletion protection stay in place, and Renovate is unaffected — it reads branch status itself rather than relying on GitHub's native auto-merge.CHANGELOG.mdis frozen at v12.1.0 with a pointer to GitHub Releases, which becomes the canonical changelog and is generated from the same labels via the new.github/release.yml.AUTHORSis left in place but is now stale: nothing regenerates it, and removing a contributor credit is a separate call.AGENTS.mdandMIGRATION.mdare updated to describe the flow that now exists.A local dry-run against this repo at the pinned action version reports
Nothing to release: no merged pull requests since the last release, which is the correct skip for the current state of master.